Home page logo

wireshark logo Wireshark mailing list archives

Re: Running tshark on large pcap files
From: Christopher Maynard <Christopher.Maynard () gtech com>
Date: Wed, 12 Jun 2013 16:42:04 +0000 (UTC)

Evan Huus <eapache ()    > writes:

And it also doesn't seem like I can split up the files with editcap.
Whenever I tried to do that with the large pcap files, I got empty output
files (24 bytes) instead. I'm not sure if it was due to the large file size.

That's odd. If you can reproduce consistently (and perhaps with a
smaller capture) please file a bug.

This might be bug 2868: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2868

Did you try passing, "-F libpcap" to editcap?

Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]